Regulator announcement; this article does not establish payment or the outcome of any subsequent appeal.
What happened
CNIL published its EXTIA decision on 9 September 2026, following a €300,000 fine adopted on 21 July. The case concerned people’s rights, particularly erasure requests from candidates and former employees. CNIL identified requests that were not handled and failures to tell people what had happened. It explained that automatic deletion did not remove the duty to communicate the outcome.
Source: CNIL — original source ↗
What it means for your website
A website form is the front door to a process. It is not the process itself. An enquiry can reach a shared mailbox and still be forgotten, assigned to nobody or closed without a response. For a small organisation, a simple request log with an owner, deadline and outcome can be more useful than a complicated form. Your team should distinguish a marketing unsubscribe from an erasure request: they can overlap, but they are not identical instructions. Also avoid promising to delete every record immediately, because some information may need to be retained for a valid reason.
Three useful next steps
- Assign an owner to every rights request.
- Record the decision and any relevant retention exception.
- Tell the person what you did and why.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
CNIL — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.